fix(hermes): repin published sandbox base

[apurvvkumaria]

Summary

The Hermes final image still trusted an older sandbox-base digest even after the current security-remediated base was published successfully. This change advances only that immutable trust anchor to the reviewed multi-platform manifest produced from main.

Related Issue

Refs #7144

Changes

• Repin agents/hermes/Dockerfile to ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:c925afe7c0742474166a4813a59f5961a93da4d130e9b35fb04088a384702142.
• Keep the existing final-image remediation and validation layers unchanged.
• Preserve the tracked-digest-first resolver contract used by Hermes builds and E2E.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification: the existing resolver, immutable-pin, final-layout, and E2E base-identity contracts deliberately accept any one reviewed 64-hex digest and passed against the new pin.
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this changes only an internal immutable image digest; no command, option, configuration, API, policy, workflow, or user action changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent focused review verified that successful publisher run 30195335992 built the digest from main commit a02831b2, that later commits changed no base-image input, that no open PR duplicates the repin, and that the immutable manifest resolves to the expected supported architectures.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed agents/hermes/Dockerfile, the full diff, Hermes manifest, image/rebuild documentation, and docs/security/sandbox-base-2026-07-25-dependency-review.md. The immutable digest repin requires no user-facing documentation change. Validation: CLI base-image 29/29; integration resolver/layout/updater 75/75; E2E-support identity/publication 45/45; build:cli; typecheck:cli; and diff check passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 10 CLI resolver tests, 79 integration layout/resolver tests, and 18 E2E-support base-identity tests passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not applicable to a one-line immutable digest repin; npm run build:cli, npm run typecheck:cli, npm run source-shape:check, npm run test:projects:check, git diff --check, and the complete changed-file hook set passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Published Manifest Evidence

• Publisher: base-image run 30195335992, source a02831b2
• Immutable index: sha256:c925afe7c0742474166a4813a59f5961a93da4d130e9b35fb04088a384702142
• Linux amd64 child: sha256:60dabeaf36d2e304dbfb7fe971505e77cb7e833a1a81a7da2a27ff8ea19f5622
• Linux arm64 child: sha256:e1d52c73ec6e870a0eb38a3f22ffa62a74dc591c3e2c1c92db7a75ca63185169

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Chores
  • Updated the Hermes sandbox base image to a newer verified version.
  • No end-user-facing behavior or runtime configuration changes.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Hermes Dockerfile updates the pinned SHA256 digest for the hermes-sandbox-base image used by the final stage. All other build and runtime configuration remains unchanged.

Changes

Hermes container image

Layer / File(s)	Summary
Update pinned base image agents/hermes/Dockerfile	The BASE_IMAGE build argument now references the new hermes-sandbox-base SHA256 digest.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: platform: container

Suggested reviewers: prekshivyas, ericksoa, laitingsheng

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: repinning the Hermes sandbox base image digest.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7144-hermes-base-digest-repin

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 8e1c6c3 in the codex/7144-hermes-ba... branch remains at 96%, unchanged from commit d4a859a in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 8e1c6c3 in the codex/7144-hermes-ba... branch is 80%. The coverage in commit d4a859a in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main d4a859a	codex/7144-hermes-ba... 8e1c6c3	+/-
src/lib/onboard/docker-cdi.ts	80%	70%	-10%
src/lib/actions...-add-restart.ts	19%	10%	-9%
src/lib/actions...x/mcp-bridge.ts	43%	36%	-7%
src/lib/shields/index.ts	72%	67%	-5%
src/lib/actions...lution-probe.ts	93%	88%	-5%
src/lib/onboard...host-anchors.ts	94%	90%	-4%
src/lib/actions...e-validation.ts	84%	81%	-3%
src/lib/actions...confirmation.ts	69%	79%	+10%
src/lib/actions...ocker-health.ts	65%	82%	+17%
src/lib/onboard...box-prebuild.ts	74%	92%	+18%

---

_{Updated July 26, 2026 15:02 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 fewer warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, full-e2e, hermes-e2e, security-posture

2 optional E2E recommendations

• rebuild-hermes
• rebuild-hermes-stale-base

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Cover the repinned base-image contract

• Location: agents/hermes/Dockerfile:9
• Category: tests
• Problem: The Dockerfile selects a new Hermes base manifest, but this PR adds no checked-in regression that verifies the selected base provides the runtime contract required by the final image.
• Impact: A published manifest that lacks the expected Hermes runtime surface can reach image assembly without a focused regression identifying the incompatible base contract.
• Recommendation: Add a focused image-contract regression for the selected manifest. Verify the expected Hermes executable and required runtime surfaces, and fail when the manifest does not provide them.
• Verification: Inspect the image-contract test inventory and the Dockerfile build checks for a test that resolves sha256:c925afe7c0742474166a4813a59f5961a93da4d130e9b35fb04088a384702142 and asserts its required runtime contract.
• Test coverage: A manifest-pinned image-contract regression that builds the final Hermes image from this digest, asserts the Hermes executable and required runtime surfaces, and has a negative fixture for a base that lacks that contract.
• Evidence: `agents/hermes/Dockerfile:9` changes the immutable base manifest digest. The test context reports no changed test files and no nearby static coverage for `agents/hermes/Dockerfile`. The risk plan requires the pinned dependencies to produce a usable agent and preserve sandbox-boundary readiness and isolation.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Additional independent evidence that #7582 is a hard prerequisite for messaging-plan validation:

• perf(messaging): stabilize image plan cache identity #7589's exact-head selected E2E run https://github.com/NVIDIA/NemoClaw/actions/runs/30203756186 reached channels-stop-start (hermes) on a healthy hosted runner.
• The job completed normally, uploaded artifacts, and cleaned up; this was not runner loss.
• Initial Hermes onboarding failed because pinned base fa052… contains npm 11.13.0 while the Dockerfile requires npm 11.18.0.
• The subsequent classic-builder RUN --mount failure is only fallback masking; fix(hermes): preserve managed BuildKit failures #7586 addresses that diagnostic path.

#7589 does not touch the Hermes Dockerfile or builder selection, so the selected Hermes lane cannot validate its plan-cache behavior until this repin to reviewed c925… lands. No rerun or duplicate pin change is planned.

[apurvvkumaria]

The exact-head E2E failure is unrelated to this one-line Hermes base repin:

• Child run 30207389748 passed hermes-e2e, Hermes security-posture, and cloud-onboard.
• The only failure was OpenClaw full-e2e.
• Install and first turn completed successfully, returned the exact sentinel, used BuildKit without fallback, and stayed inside every total/phase/silence budget.
• The sole overage was root-end-to-first-turn: 14.492s > 14s.
• Internal agent latency rose to 8.916s while wrapper overhead stayed stable, identifying a hosted-inference tail rather than runner loss or fix(hermes): repin published sandbox base #7582 behavior.

The exact existing tracker #6660 has been reopened with the full sample analysis and added under stability epic #7140. The proposed fix is statistical/anomaly classification for a sole functional-success latency tail—not a blind rerun or a 14→15 second threshold bump.

No #7582 code change is indicated by this run. A maintainer can treat the E2E non-success as an unrelated false red with #6660 as the follow-up.